Getting Data In

After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

493669
Super Champion

Hi,
In Splunk 6.4.5 standalone on Windows. After creating an app, I added a stanza in transforms.conf and collections.conf in default folder. Then after adding few entries in that KV Store i am able to see through |inputlookup command
Then i added transforms.conf and collections.conf in the local folder of the app and then added stanza for KV Store, but when i tried |inputlookup command it gives me error as "The lookup table is invalid".
Please advise.

1 Solution

493669
Super Champion

Finally issue is resolved now. It was permission issue on my windows as suggested.
On Splunk Folder >Propperties>Security Tab>Advanced>In Advanced Security Settings>Given Full Control Access for particular User-Admin and tick on checkbox-"Replace all child object permission entries with inheritable permission entries from this object".
Then Apply these settings.
Thanks @MuS @woodcock and @mattymo

View solution in original post

493669
Super Champion

Finally issue is resolved now. It was permission issue on my windows as suggested.
On Splunk Folder >Propperties>Security Tab>Advanced>In Advanced Security Settings>Given Full Control Access for particular User-Admin and tick on checkbox-"Replace all child object permission entries with inheritable permission entries from this object".
Then Apply these settings.
Thanks @MuS @woodcock and @mattymo

MuS
SplunkTrust
SplunkTrust

Happy you were able to resolve this issue. Feel free to vote for any other answer or comment that helped you with this problem, especially for those who helped out offline 😉

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi 493669,

Since you've never provided the actual search command you used, I wonder if you use the stanza name set in collections.conf instead the one from transforms.conf?

I took your posted config files and it works just fine:

alt text
After adding some random values to it I can get them back as well using the stanza name from transforms.conf:

alt text
Where as I get the same error as you got when using |inputlookup sample.

Here are the config files used:

collections.conf

[sample]
field.test = string
field.check = string
replicate = true

transforms.conf

[sample_store]
external_type = kvstore
collection = sample
fields_list = test, check

Hope this helps ...

cheers, MuS

493669
Super Champion

Hi MuS,
When I am trying |inputlookup command I am using transforms.conf stanza name only . As @woodcock suggested to make both header stanza same in transforms.conf and collections.conf so tried with |inputlookup sample but it not worked.
now i tried the stanza provided and tried |inputlookup sample_store but still it gives error as

The lookup table 'sample_store' is
invalid.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi 493669, if you want I email you and we can solve this offline?

0 Karma

493669
Super Champion

yes sure...

0 Karma

woodcock
Esteemed Legend

If you go to transforms.conf and change this:

[sample_store]

to this:

[sample]

then it will work (or at least it did for me). You could make the opposite change in collections.conf; the point is that when you make both stanza headers match, then it works. I could not find any documentation stating that the names must match, and, as we both discovered, Splunk does not complain upon instantiation if they do not, but it does complain when you try to read/write to the lookup.

0 Karma

493669
Super Champion

after making same header stanza for both transforms.conf and collection.conf still gives me error as "The lookup table 'sample' is invalid".
when i tried to create kv store through lookup definition it is get created but unable to set permission from private to global. it gives error as "Splunk could not update permissions for resource data/transforms/lookups [HTTP 500] Splunkd internal error; [{'type': 'ERROR', 'code': None, 'text': "\n In handler 'transforms-lookup': Data could not be written: /nobody/Test/transforms/ui/fields_list: ui, collectionName, app"}"

0 Karma

woodcock
Esteemed Legend

From the CLI, inside the app where the collection exists, create default.meta file in the metadata directory with this:

[collections]
export = system
[lookups]
export = system

Then manually remove any entries that you have for sample from your local.meta file. I don't know why the GUI would be having problems but it may be because these 2 files do not have the correct ownership or permissions.

0 Karma

493669
Super Champion

added below stanza in default.meta :

 [collections]
export = system

and

[lookups]
 export = system 

this stanza already present.
checked local.meta but i did not find any sample entry .below stanza are present in local.meta

[app/ui]
version = 6.4.5
modtime = 1491051965.784553700

[app/launcher]
version = 6.4.5
modtime = 1491051965.929988500

still gives same error

0 Karma

woodcock
Esteemed Legend

Did you hit the debug/refresh endpoint or restart splunk on the Search Head?

0 Karma

493669
Super Champion

After debug/refresh i get following errors:
1.

Refreshing admin/crl                       ResourceNotFound 
 In handler 'crl': Invalid action for this internal handler (handler: crl, supported: list|_reload, wanted: list).

2.

Refreshing admin/remote_indexes            BadRequest 
 In handler 'remote_indexes': The following required arguments are missing: repositoryLocation.
0 Karma

woodcock
Esteemed Legend

Those 2 errors are normal; I always see them, even on a fresh install so that is not it. After the debug/refresh, are you still getting some search |outputlookup errors (forget about |inputlookup until we get outputlookup working)?

0 Karma

493669
Super Champion

After trying ...|outputlookup sample get same error as

"Error in 'outputlookup' command: The
lookup table 'sample' is invalid."

0 Karma

woodcock
Esteemed Legend

You should DEFINITELY open a support case. Be sure to followup and let us all know what the conclusion/fix turns out to be.

0 Karma

493669
Super Champion

I am unable to open support case as it shows "It appears you do not have an active Support Contract or entitlement and as a result, cannot open a Support case."

0 Karma

woodcock
Esteemed Legend

Pick an question and stick to it; do not keep opening the same question over and over.

0 Karma

starcher
SplunkTrust
SplunkTrust

If you provide your config stanzas it would be easier for someone to provide some guidance.

0 Karma

493669
Super Champion

in Local folder-
Collections.conf
[sample]
field.test = string
field.check = string
replicate = true

Transforms.conf
[sample_store]
external_type = kvstore
collection = sample
fields_list = test, check

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...